<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
    "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<meta name="generator" content="AsciiDoc 8.6.8" />
<link rel="Shortcut Icon" href="/images/favicon.ico" type="image/x-icon" />
<title></title>
<link rel="stylesheet" href="asciidoc-2.css" tppabs="http://old.peachfuzzer.com/v2/asciidoc.css" type="text/css" />
<link rel="stylesheet" href="website-2.css" tppabs="http://old.peachfuzzer.com/v2/website.css" type="text/css" />
</head>

<body>

<div id="layout-menu-box">
<div id="layout-menu">
  <div><a href="WhatIsPeach.html" tppabs="http://old.peachfuzzer.com/WhatIsPeach.html">What is Peach</a></div>
  <div><a href="Installation.html" tppabs="http://old.peachfuzzer.com/v3/Installation.html"><b>Installing</b></a></div>
  <div><a href="PeachQuickStart.html" tppabs="http://old.peachfuzzer.com/v3/PeachQuickStart.html"><b>Tutorials</b></a></div>
  <div><a href="Methodology.html" tppabs="http://old.peachfuzzer.com/Methodology.html">Methodology</a></div>
  <div><a href="Introduction.html" tppabs="http://old.peachfuzzer.com/Introduction.html">Introduction</a></div>
  <div><a href="Training.html" tppabs="http://old.peachfuzzer.com/Training.html">Training</a></div>
  <div><a href="javascript:if(confirm(%27http://www.dejavusecurity.com/peach.html  \n\nThis file was not retrieved by Teleport Ultra, because it is addressed on a domain or path outside the boundaries set for its Starting Address.  \n\nDo you want to open it from the server?%27))window.location=%27http://www.dejavusecurity.com/peach.html%27" tppabs="http://www.dejavusecurity.com/peach.html">Enterprise</a></div>
  <div><a href="FAQ.html" tppabs="http://old.peachfuzzer.com/v3/FAQ.html">FAQ</a></div>
  <div><a href="javascript:if(confirm(%27http://forums.peachfuzzer.com/forum.php  \n\nThis file was not retrieved by Teleport Ultra, because it is addressed on a domain or path outside the boundaries set for its Starting Address.  \n\nDo you want to open it from the server?%27))window.location=%27http://forums.peachfuzzer.com/forum.php%27" tppabs="http://forums.peachfuzzer.com/forum.php">Support Forums</a></div>

  <div><h5>Peach 3</h5></div>
  <div><img src="1.gif" tppabs="http://old.peachfuzzer.com/images/1.gif" /><a href="PeachPit.html" tppabs="http://old.peachfuzzer.com/v3/PeachPit.html">Peach Pits</a></div>
  <div>&nbsp;<img src="1.gif" tppabs="http://old.peachfuzzer.com/images/1.gif" /><a href="GeneralConfiguration.html" tppabs="http://old.peachfuzzer.com/v3/GeneralConfiguration.html">General Conf</a></div>
  <div>&nbsp;<img src="1.gif" tppabs="http://old.peachfuzzer.com/images/1.gif" /><a href="DataModeling.html" tppabs="http://old.peachfuzzer.com/v3/DataModeling.html">Data Modeling</a></div>
  <div>&nbsp;<img src="1.gif" tppabs="http://old.peachfuzzer.com/images/1.gif" /><a href="StateModel.html" tppabs="http://old.peachfuzzer.com/v3/StateModel.html">State Modeling</a></div>
  <div>&nbsp;<img src="1.gif" tppabs="http://old.peachfuzzer.com/images/1.gif" /><a href="AgentsMonitors.html" tppabs="http://old.peachfuzzer.com/v3/AgentsMonitors.html">Agents</a></div>
  <div>&nbsp;&nbsp;<img src="1.gif" tppabs="http://old.peachfuzzer.com/images/1.gif" /><img src="1.gif" tppabs="http://old.peachfuzzer.com/images/1.gif" /><a href="AgentsMonitors.html" tppabs="http://old.peachfuzzer.com/v3/AgentsMonitors.html">Monitors</a></div>
  <div>&nbsp;<img src="1.gif" tppabs="http://old.peachfuzzer.com/images/1.gif" /><a href="TestConfig.html" tppabs="http://old.peachfuzzer.com/v3/TestConfig.html">Test</a></div>
        <div>&nbsp;&nbsp;<img src="1.gif" tppabs="http://old.peachfuzzer.com/images/1.gif" /><img src="1.gif" tppabs="http://old.peachfuzzer.com/images/1.gif" /><a href="Publisher.html" tppabs="http://old.peachfuzzer.com/v3/Publisher.html">Publishers</a></div>
  <div>&nbsp;&nbsp;<img src="1.gif" tppabs="http://old.peachfuzzer.com/images/1.gif" /><img src="1.gif" tppabs="http://old.peachfuzzer.com/images/1.gif" /><a href="Logger.html" tppabs="http://old.peachfuzzer.com/v3/Logger.html">Loggers</a></div>
  <!-- <div>&nbsp;<img src="/images/1.gif" /><a href="/v3/DebuggingPitFiles.html">Debugging Pits</a></div> -->
  <!-- <div>&nbsp;<img src="/images/1.gif" /><a href="/v3/ValidatingPitFiles.html">Validating Pits</a></div> -->
  <div><img src="1.gif" tppabs="http://old.peachfuzzer.com/images/1.gif" /><a href="RunningPeach.html" tppabs="http://old.peachfuzzer.com/v3/RunningPeach.html">Running</a></div>
  <!-- <div><img src="/images/1.gif" /><a href="/v3/ParallelPeach.html">Parallel</a></div> -->
  <!-- <div><img src="/images/1.gif" /><a href="/v3/ExtendingPeach.html">Extending</a></div> -->
  <div><img src="1.gif" tppabs="http://old.peachfuzzer.com/images/1.gif" /><a href="minset.html" tppabs="http://old.peachfuzzer.com/v3/minset.html">Minset</a></div>

  <div><h5><a href="peach23.html" tppabs="http://old.peachfuzzer.com/v2/peach23.html">Peach 2.3</a></h5></div>

  <div><hr/></div>

  <div><a href="License.html" tppabs="http://old.peachfuzzer.com/License.html">License</a></div>
</div>
</div>
<div id="layout-content-box">
<div id="layout-banner">
  <div id="layout-title">
    <a href="index.htm" tppabs="http://old.peachfuzzer.com/"><img src="peach_fuzzer.png" tppabs="http://old.peachfuzzer.com/images/peach_fuzzer.png" height="100" /></a>
    <a href="javascript:if(confirm(%27http://www.dejavusecurity.com/peach.html  \n\nThis file was not retrieved by Teleport Ultra, because it is addressed on a domain or path outside the boundaries set for its Starting Address.  \n\nDo you want to open it from the server?%27))window.location=%27http://www.dejavusecurity.com/peach.html%27" tppabs="http://www.dejavusecurity.com/peach.html" class="layout-inner-banner-right">
                <img height="50" src="dejavusecurity.png" tppabs="http://old.peachfuzzer.com/images/dejavusecurity.png" /></a>
  </div>

  <div id="layout-description">
  <script>
  (function() {
    var cx = '007028538774543840348:g-0dlrdlmxs';
    var gcse = document.createElement('script'); gcse.type = 'text/javascript'; gcse.async = true;
    gcse.src = (document.location.protocol == 'https:' ? 'https:' : 'http:') +
        '//www.google.com/cse/cse.js?cx=' + cx;
    var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(gcse, s);
  })();
</script>
<gcse:search></gcse:search>
      </div>
</div>
<div id="layout-content">
<div id="content">
<div class="sect1">
<h2 id="_tools">Tools</h2>
<div class="sectionbody">
<div class="paragraph"><p>Peach comes with a growing collection of tools to help build, test, and provide coverage information about your fuzzer.  Below are some of the tools currently included in Peach.</p></div>
</div>
</div>
<div class="sect1">
<h2 id="_minimum_set">Minimum Set</h2>
<div class="sectionbody">
<div class="paragraph"><p>This tool will run each sample file through a target program and determine code coverage.  It will then find the least number of files needed to cover the most code.  This will be the minimum set of files that should be used when fuzzing.</p></div>
<div class="paragraph"><p>This tool currently only supports command line programs that will exit by themselves.</p></div>
<div class="listingblock">
<div class="content">
<pre><code>C:\peach\tools\minset&gt;python minset.py

] Peach Minset Finder v0.1
] Copyright (c) Michael Eddington

Syntax: minset.py target.exe samples\folder command.exe  "args %s"

  target.exe   The target executable or ddl that
               contains the core parser logic.
  samples      The folder containing the sample files
               for which we will find the min.
  command      The command line of the program to run.
               the command line MUST contain a %%s which
               will get substututed for the sample filename.</code></pre>
</div></div>
<div class="paragraph"><p><strong>Example run:</strong></p></div>
<div class="listingblock">
<div class="content">
<pre><code>C:\peach\tools\minset&gt;python minset.py bin\pngcheck.exe samples\basn0g*.png bin\pngcheck.exe %s

] Peach Minset Finder v0.1
] Copyright (c) Michael Eddington

[*] Finding all basic blocks in [bin\pngcheck.exe]
[*] Found 3636 basic blocks and 5 sample files
[*] Determining coverage with [samples\basn0g01.png]....
OK: samples\basn0g01.png (32x32, 1-bit grayscale, non-interlaced, -28.1%).
[-] samples\basn0g01.png hit 316 blocks
[*] Determining coverage with [samples\basn0g02.png]....
OK: samples\basn0g02.png (32x32, 2-bit grayscale, non-interlaced, 59.4%).
[-] samples\basn0g02.png hit 314 blocks
[*] Determining coverage with [samples\basn0g04.png]....
OK: samples\basn0g04.png (32x32, 4-bit grayscale, non-interlaced, 71.7%).
[-] samples\basn0g04.png hit 314 blocks
[*] Determining coverage with [samples\basn0g08.png]....
OK: samples\basn0g08.png (32x32, 8-bit grayscale, non-interlaced, 86.5%).
[-] samples\basn0g08.png hit 314 blocks
[*] Determining coverage with [samples\basn0g16.png]....
OK: samples\basn0g16.png (32x32, 16-bit grayscale, non-interlaced, 91.8%).
[-] samples\basn0g16.png hit 314 blocks
[*] Master template is [samples\basn0g01.png] with a coverage of 316 blocks

[*] Minimum set is 2 of 5 files:
[-]    samples\basn0g01.png
[-]    samples\basn0g02.png</code></pre>
</div></div>
</div>
</div>
<div class="sect1">
<h2 id="_choice_coverage_check">Choice Coverage Check</h2>
<div class="sectionbody">
<div class="paragraph"><p>This tool will analyze a set of sample files against a provided Peach PIT and Data model.  It will then determine which if any choices of Choice elements are not hit by these sample files.  This allows additional insight into what parts of a target are being exercised.</p></div>
<div class="listingblock">
<div class="content">
<pre><code>C:\peach\tools\minset&gt;python missing.py

] Peach Choice Coverage Check
] Copyright (c) Michael Eddington


Syntax: missing.py MyPit.xml DataModelName samples\*.png

This tool will crack every file provided into the specified
data model and then determin if any of the choice blocks
are not covered by the provided files.</code></pre>
</div></div>
<div class="paragraph"><p><strong>Example run:</strong></p></div>
<div class="listingblock">
<div class="content">
<pre><code>C:\peach\tools\minset&gt;python missing.py png.xml Png samples\*.png

] Peach Choice Coverage Check
] Copyright (c) Michael Eddington

[*] Parsing pit file: png.xml
[*] Cracking file: samples\basn0g01.png
../..\Peach\Transformers\type.py:200: DeprecationWarning: struct integer overflo
w masking is deprecated
  return struct.pack(packStr, long(data))
[*] Cracking file: samples\basn0g02.png
[*] Cracking file: samples\basn0g04.png
[*] Cracking file: samples\basn0g08.png
[*] Cracking file: samples\basn0g16.png
[*] Cracking file: samples\basn2c08.png
[*] Cracking file: samples\basn2c16.png
[*] Cracking file: samples\basn3p01.png
[*] Cracking file: samples\basn3p02.png
[*] Cracking file: samples\basn3p04.png
[*] Cracking file: samples\basn3p08.png
[*] Cracking file: samples\basn4a08.png
[*] Cracking file: samples\basn4a16.png
[*] Cracking file: samples\basn6a08.png
[*] Cracking file: samples\basn6a16.png
[!] Missing: Png.Unknown Element 55.TheChunkcHRM
[*] Done</code></pre>
</div></div>
</div>
</div>
<div class="sect1">
<h2 id="_struct_to_peach">Struct to Peach</h2>
<div class="sectionbody">
<div class="paragraph"><p>This tool will scan headers, C files, or 010 Templates and convert structures into Peach XML.  This can be a huge time saver for complex file formats that have hundreds of structures.</p></div>
<div class="listingblock">
<div class="content">
<pre><code>C:\peach\tools&gt;perl struct2peach.pl
] c-struct2peach v0.3
] Copyright (c) 2007-2008 Michael Eddington
] mike@phed.org

Syntax: struct2peach.pl [little|big] &lt; filename.h &gt; gens.xml

  Please specify endianness</code></pre>
</div></div>
</div>
</div>
</div>
<div id="footnotes"></div>
<div id="footer">
<div id="footer-text">

<table width="100%">
<td><td>
<a href="javascript:if(confirm(%27http://dejavusecurity.com/  \n\nThis file was not retrieved by Teleport Ultra, because it is addressed on a domain or path outside the boundaries set for its Starting Address.  \n\nDo you want to open it from the server?%27))window.location=%27http://dejavusecurity.com/%27" tppabs="http://dejavusecurity.com/"><img src="dejavusecurity.png" tppabs="http://old.peachfuzzer.com/images/dejavusecurity.png" height="50"/></a>
</td><td>&nbsp;&nbsp;&nbsp;</td><td>

Copyright (c) <a href="javascript:if(confirm(%27http://dejavusecurity.com/  \n\nThis file was not retrieved by Teleport Ultra, because it is addressed on a domain or path outside the boundaries set for its Starting Address.  \n\nDo you want to open it from the server?%27))window.location=%27http://dejavusecurity.com/%27" tppabs="http://dejavusecurity.com/">Deja vu Security</a> <br/>
Last updated 2014-02-23 21:22:04 PST
</td>
</table>

<script type="text/javascript">

  var _gaq = _gaq || [];
  _gaq.push(['_setAccount', 'UA-1094513-10']);
  _gaq.push(['_trackPageview']);

  (function() {
    var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
    ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www/') + '.google-analytics.com/ga.js';
    var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
  })();

</script>
</div>
</div>
</div>
</div>
</body>
</html>
